Thousands of universities were hacked in the largest educational security breach ever. Here's what to do when your children's personal data is stolen

"Who did it and what are they going to do with the data?" she said, during an interview with ABC 11 (1).

The Canvas breach is part of a bigger problem

Canvas, for those unfamiliar, is an online platform that allows students to access schoolwork, submit assignments and store grades. For university students, financial details factor in far greater than with high schools. To be clear, though, there is no evidence suggesting passwords, dates of birth or financial information were shared.

At Mississippi State University, Aubrey Palmer, a meteorology student, told the BBC (2) they had just finished a 2,900-word essay exam when they received an alert on their screens.

"ShinyHunters has breached Instructure (again)," it read.

ShinyHunters (3) is a hacker and extortion group that has been active since 2020. It has been responsible for several massive data breaches, data theft and extortion efforts targeting global corporations and organizations like AT&T (4), Google (5) and Ticketmaster (6).

ShinyHunters typically does its work by making English-language phone calls and impersonating employees to trick company staff into granting access. In this instance, they exploited flaws in the Free-For-Teacher accounts on April 29. Canvas owner and developer Instructure said hackers were able to obtain names, email addresses, student ID numbers and user messages.

The threat was thought to have receded, but ShinyHunters regained access the very next day, on April 30.

This is not a one-off either. In 2024, logins and credentials for PowerSchool contract employees were compromised (7), exposing names, addresses and email information. The North Carolina Department of Public Instruction shifted all of their information to an online portal.